Overview

Request 993799 superseded

- Update to version 8.5.10
+ Security:
* Fixes CVE-2022-29170, CVE-2022-31107 and CVE-2022-31097
* Fixes minor code scanning security warnings in old vendored
javascript libs
+ Several other features, enhancements and bug fixes since 8.3.5

Witek Bedyk's avatar
Witek Bedyk (witekbedyk) -
target maintainer

Thank you for the contribution.

This package has a different build procedure. Have you compiled the frontend assets with the provided Makefile?

Please add important changes from all versions since 8.3.5 to the changelog similarly as it had been done previously.

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

This package has a different build procedure. Have you compiled the frontend assets with the provided Makefile?

Good catch. I remember it was once forgotten and the web UI was completely broken. So I'll regenerate them and will test locally whether the UI works.

Please add important changes from all versions since 8.3.5 to the changelog similarly as it had been done previously.

Is there a tool to automate this job? Otherwise it seems rather tedious with zero benefit as people can simply look on GitHub. (Why C&P stuff instead of just referencing? Even the referencing seems useless considering one should know where to find this.)

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

Unfortunately it doesn't work:

➤ YN0007: │ grafana@workspace:. must be built because it never has been before or the last one failed
➤ YN0009: │ grafana@workspace:. couldn't be built successfully (exit code 1, logs can be found here: /tmp/xfs-8e535955/build.log)
➤ YN0000: └ Completed in 7s 140ms
➤ YN0000: Failed with errors in 14s 778ms
make: *** [Makefile:14: tar] Fehler 1

The log file contains:

# This file contains the result of Yarn building a package (grafana@workspace:.)
# Script name: postinstall

.git can't be found (see https://git.io/Jc3F9)

Maybe I can dig a little bit further but I'm not an expert with these build systems and I'm also not familiar with the Grafana code base at all.

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

Looks like a little git init let's me get past this. Not sure whether it has any negative consequences, though.

Now webpack coredumps:

Compiling message catalogs…
Done!
Browserslist: caniuse-lite is outdated. Please run:
  npx browserslist@latest --update-db
  Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating

<--- Last few GCs --->

[28531:0x55d8d4c50180]   293473 ms: Mark-sweep 3982.9 (4133.6) -> 3967.5 (4134.1) MB, 2125.1 / 0.0 ms  (average mu = 0.101, current mu = 0.014) allocation failure scavenge might not succeed
[28531:0x55d8d4c50180]   295665 ms: Mark-sweep 3984.2 (4134.8) -> 3968.7 (4135.3) MB, 2146.0 / 0.0 ms  (average mu = 0.062, current mu = 0.021) allocation failure scavenge might not succeed


<--- JS stacktrace --->

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
 1: 0x55d8d2152d90 node::Abort() [webpack]
 2: 0x55d8d2058e3e node::FatalError(char const*, char const*) [webpack]
 3: 0x55d8d2330432 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, bool) [webpack]
 4: 0x55d8d23307e1 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, bool) [webpack]
 5: 0x55d8d24d57b5  [webpack]
 6: 0x55d8d24d590a  [webpack]
 7: 0x55d8d24e3129 v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::GCCallbackFlags) [webpack]
 8: 0x55d8d24e3b9f v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [webpack]
 9: 0x55d8d24e6d9b v8::internal::Heap::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [webpack]
10: 0x55d8d24e6e28 v8::internal::Heap::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [webpack]
11: 0x55d8d24acd53 v8::internal::Factory::NewFillerObject(int, bool, v8::internal::AllocationType, v8::internal::AllocationOrigin) [webpack]
12: 0x55d8d27edf69 v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [webpack]
13: 0x55d8d2bafbb9  [webpack]
make: *** [Makefile:14: tar] Fehler 129

Maybe it'll just work on the 2nd attempt.

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

export NODE_OPTIONS=--max_old_space_size=8192 does the trick but now the package build fails

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

It builds now. I've also built it locally via osc build and installed the resulting package. The web UI works under the new version. I've also updated the changelog as requested but I find it quite useless.

Marius Kittler's avatar
Marius Kittler (mkittler) -
author target maintainer

Looks like this SR hasn't been updated after pushing new changes so I've created https://build.opensuse.org/request/show/994121.

Request History
Marius Kittler's avatar

mkittler created request

- Update to version 8.5.10
+ Security:
* Fixes CVE-2022-29170, CVE-2022-31107 and CVE-2022-31097
* Fixes minor code scanning security warnings in old vendored
javascript libs
+ Several other features, enhancements and bug fixes since 8.3.5

Marius Kittler's avatar

mkittler superseded request

openSUSE Build Service is sponsored by
Places